Read the docs
TI-2022-05177 Aliases CVE-2022-20618GHSA-w2mh-6xj5-f77f

Missing authorization in Jenkins Bitbucket Branch Source Plugin

Priority LOW 22CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
Partial Red Hat: 2 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-862.

Summary

A missing permission check in Jenkins Bitbucket Branch Source Plugin 737.vdf9dc06105be and earlier allows attackers with Overall/Read access to enumerate credentials IDs of credentials stored in Jenkins.

Why it matters now

EPSS 0.0088 59th percentileScored 2026-11-07
Fix Partial Jenkins Bitbucket Branch Source Plugin (Jenkins project): 725.vd9f8be0fa250, 2.9.11.2, 2.9.7.2org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source (Maven): 746.v350d2781c184, 725.vd9f8be0fa250, 2.9.11.2 +1Red Hat: 2 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
JenkinsJenkins Bitbucket Branch Source Pluginup to 737.vdf9dc06105be725.vd9f8be0fa250, 2.9.11.2, 2.9.7.2Patch availableCNA
—org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source (Maven)726.v7e6f53de133c to before 746.v350d2781c184746.v350d2781c184Patch availableGHSA-w2mh-6xj5-f77f
—org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source (Maven)720.vbe985dd73d66 to before 725.vd9f8be0fa250725.vd9f8be0fa250Patch availableGHSA-w2mh-6xj5-f77f
—org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source (Maven)2.9.8 to before 2.9.11.22.9.11.2Patch availableGHSA-w2mh-6xj5-f77f
—org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source (Maven)before 2.9.7.22.9.7.2Patch availableGHSA-w2mh-6xj5-f77f
  • Jenkins Bitbucket Branch Source Plugin VendorJenkins Affected up to 737.vdf9dc06105be Fixed in 725.vd9f8be0fa250, 2.9.11.2, 2.9.7.2 Patch available CNA
  • org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source (Maven) Vendor— Affected 726.v7e6f53de133c to before 746.v350d2781c184 Fixed in 746.v350d2781c184 Patch available GHSA-w2mh-6xj5-f77f
  • org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source (Maven) Vendor— Affected 720.vbe985dd73d66 to before 725.vd9f8be0fa250 Fixed in 725.vd9f8be0fa250 Patch available GHSA-w2mh-6xj5-f77f
  • org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source (Maven) Vendor— Affected 2.9.8 to before 2.9.11.2 Fixed in 2.9.11.2 Patch available GHSA-w2mh-6xj5-f77f
  • org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source (Maven) Vendor— Affected before 2.9.7.2 Fixed in 2.9.7.2 Patch available GHSA-w2mh-6xj5-f77f

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:jenkins:bitbucket_branch_source:*:*:*:*:*:jenkins:*:*up to 2.9.10VulnerableJenkins
cpe:2.3:a:jenkins:bitbucket_branch_source:737.vdf9dc06105be:*:*:*:*:jenkins:*:*737.vdf9dc06105beVulnerableJenkins
  • cpe:2.3:a:jenkins:bitbucket_branch_source:*:*:*:*:*:jenkins:*:* Versions up to 2.9.10 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:bitbucket_branch_source:737.vdf9dc06105be:*:*:*:*:jenkins:*:* Versions 737.vdf9dc06105be Vulnerable ·Jenkins

Remediation

  • Fix · CNA Jenkins Bitbucket Branch Source Plugin (Jenkins project) Fixed in 725.vd9f8be0fa250, 2.9.11.2, 2.9.7.2
  • Fix · GHSA-w2mh-6xj5-f77f org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source (Maven) Fixed in 746.v350d2781c184 Advisory →
  • Fix · GHSA-w2mh-6xj5-f77f org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source (Maven) Fixed in 725.vd9f8be0fa250 Advisory →
  • Fix · GHSA-w2mh-6xj5-f77f org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source (Maven) Fixed in 2.9.11.2 Advisory →
  • Fix · GHSA-w2mh-6xj5-f77f org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source (Maven) Fixed in 2.9.7.2 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift Container Platform 3.11AffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 4AffectedNo fix yet

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-20618
  2. 2026-10-03 Alias added: GHSA-w2mh-6xj5-f77f

References

Advisory 3

Other 3

  • TI-2022-05178 Cross-site request forgery in Jenkins Bitbucket Branch Source Plugin CVSS 3.1HIGH 7.1
  • TI-2024-18730 In Jenkins Bitbucket Branch Source Plugin 866.vdea_7dcd3008e and earlier, except… CVSS 3.1MEDIUM 6.3
  • TI-2024-26395 Sensitive information in log files in Jenkins Bitbucket Branch Source Plugin CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences